diff --git a/argocd/apps/tailscale-operator-ringtail.yaml b/argocd/apps/tailscale-operator-ringtail.yaml
index a261354..1e15d09 100644
--- a/argocd/apps/tailscale-operator-ringtail.yaml
+++ b/argocd/apps/tailscale-operator-ringtail.yaml
@@ -11,8 +11,7 @@ spec:
   project: default
   # Tailscale operator mutates externalName from "placeholder" to actual proxy service
   ignoreDifferences:
-    - group: ""
-      kind: Service
+    - kind: Service
       jsonPointers:
         - /spec/externalName
   source:
diff --git a/argocd/apps/tailscale-operator.yaml b/argocd/apps/tailscale-operator.yaml
index 4ca5ea7..9e95c16 100644
--- a/argocd/apps/tailscale-operator.yaml
+++ b/argocd/apps/tailscale-operator.yaml
@@ -9,8 +9,7 @@ spec:
   project: default
   # Tailscale operator mutates externalName from "placeholder" to actual proxy service
   ignoreDifferences:
-    - group: ""
-      kind: Service
+    - kind: Service
       jsonPointers:
         - /spec/externalName
   source:
diff --git a/docs/changelog.d/+fix-apps-outofsync.bugfix.md b/docs/changelog.d/+fix-apps-outofsync.bugfix.md
new file mode 100644
index 0000000..00faf4f
--- /dev/null
+++ b/docs/changelog.d/+fix-apps-outofsync.bugfix.md
@@ -0,0 +1 @@
+Remove `group: ""` from tailscale-operator ignoreDifferences — ArgoCD normalizes away the empty string, causing permanent OutOfSync on the apps app.